<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: drivers]]></title>
    <link>http://securityratty.com/tag/drivers</link>
    <description></description>
    <pubDate>Tue, 22 Jul 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[FileAdvisor: software file search engine]]></title>
      <link>http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103</link>
      <guid>http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103</guid>
      <description><![CDATA[Troy Larson sent me a heads up on Bit9's FileAdvisor , a service they describe as &quot;a comprehensive catalog of executables, drivers, and patches found in commercial Windows applications and software...]]></description>
      <content:encoded><![CDATA[<a href="http://www.itsec.e-symposium.com/speakers/troy-larson.php" target="_blank">Troy Larson</a> sent me a heads up on Bit9's <a href="http://fileadvisor.bit9.com/services/search.aspx" target="_blank">FileAdvisor</a>, a service they describe as "a comprehensive catalog of executables, drivers, and patches found in commercial Windows applications and software packages. Malware and other unauthorized software that affects Windows computers is also indexed." <br />I immediately checked the FileAdvisor db for malware results as well non-Windows binaries and was pleasantly surprised with immediate and comprehensive results. You do have to register, but I was further impressed with the fact that they offered the option for a short or full <a href="http://fileadvisor.bit9.com/services/register.aspx" target="_blank">registration</a>.<br />This appears to be worthy of a bookmark in your incident handler/malware researcher/forensic investigator toolkit.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html&title=FileAdvisor:%20software%20file%20search%20engine " title="FileAdvisor: software file search engine ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html" title="FileAdvisor: software file search engine ">digg</a>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 10:34:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/fileadvisor">fileadvisor</category>
      <category domain="http://securityratty.com/tag/commercial windows applications">commercial windows applications</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware results">malware results</category>
      <category domain="http://securityratty.com/tag/software packages">software packages</category>
      <category domain="http://securityratty.com/tag/affects windows computers">affects windows computers</category>
      <category domain="http://securityratty.com/tag/comprehensive results">comprehensive results</category>
      <category domain="http://securityratty.com/tag/incident handlermalware">incident handlermalware</category>
      <source url="http://holisticinfosec.blogspot.com/2008/10/fileadvisor-software-file-search-engine.html">FileAdvisor: software file search engine</source>
    </item>
    <item>
      <title><![CDATA[The Commercialization of Anti Debugging Tactics in Malware]]></title>
      <link>http://securityratty.com/article/91955d7bc08228b99c0f5fa478c039b5</link>
      <guid>http://securityratty.com/article/91955d7bc08228b99c0f5fa478c039b5</guid>
      <description><![CDATA[Commoditization or commercialization, Themida or Code Virtualizer, individually crypting or outsourcing to an experienced malware crypting service offering discounts on a volume basis next to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SN0BFks8GsI/AAAAAAAACMQ/J_vLiffz110/s1600-h/figure_multiple.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="128" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SN0BFks8GsI/AAAAAAAACMQ/bz624nz5JbE/s200-R/figure_multiple.jpg" width="200" /></a><a href="http://ddanchev.blogspot.com/2008/09/commoditization-of-anti-debugging.html">Commoditization</a> or commercialization, Themida or Code Virtualizer, individually crypting or outsourcing to an experienced malware crypting service offering discounts on a volume basis next to detection rates of the crypted binary offered by a trusted online scanner that is NOT distributing the samples to the vendors? These are just some of the questions malware authors often ask themselves, while others distribute pirated copies of Code Virtualizer urging everyone to start taking advantage of commercial anti-reverse engineering tools to make their malware harder to analyze. Once again, just like we've seen before, a legitimate commercial application can come handy in the hands of the wrong people :<br />
<br />
"<i>Code Virtualizer will convert your original code (Intel x86 instructions) into Virtual Opcodes that will only be understood by an internal Virtual Machine. Those Virtual Opcodes and the Virtual Machine itself are unique for every protected application, avoiding a general attack over Code Virtualizer. Code Virtualizer can protect your sensitive code areas in any x32 and x64 native PE files (like executable files/EXEs, system services, DLLs , OCXs , ActiveX controls, screen savers and device drivers).</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SN0CPwG9MzI/AAAAAAAACMY/lB8WtKqycj4/s1600-h/cvprotopt.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="149" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SN0CPwG9MzI/AAAAAAAACMY/kgSYpWIHW2E/s200-R/cvprotopt.png" width="200" /></a><i>Code Virtualizer can generate multiple types of virtual machines with a different instruction set for each one. This means that a specific block of Intel x86 instructions can be converted into different instruction set for each machine, preventing an attacker from recognizing any generated virtual opcode after the transformation from x86 instructions. The following picture represents how a block of Intel x86 instructions is converted into different kinds of virtual opcodes, which could be emulated by different virtual machines.</i><br />
<br />
<i>When an attacker tries to decompile a block of code that was protected by Code Virtualizer, he will not find the original x86 instructions. Instead, he will find a completely new instruction set which is not recognized by him or any other special decompiler. This will force the attacker to go through the extremely hard work of identifying how each opcode is executed and how the specific virtual machine works for each protected application. Code Virtualizer totally obfuscates the execution of the virtual opcodes and the study of each unique virtual machine in order to prevent someone from studying how the virtual opcodes are executed.</i>"<br />
<br />
With Cyber-as-a-Service business model becoming increasingly common, the entire <a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">quality assurance model in respect to malware</a> is slowly maturing from individual malware crypting propositions, where the seller of the service is basically taking advantage of a diverse set of public/private tools, into DIY web services offering crypting discounts on a volume basis, and perhaps most importantly - improving the customer's experience by letting him take advantage of the inventory of crypting tools and bypassing verification services. Within the tool's inventory are naturally lots of (pirated) commercial anti-reverse engineering tools.<br />
<br />
As we've seen before, whenever someone starts commercializing what used to be a self-selving process, others will either follow, or disintermediate their services by persistently releasing crypting tools for free in the wild. At the end of the day, it's all a matter of how serious they're about commercializing this market segment, and taking into consideration that a spamming vendor is offering malware crypting services "in between" the rest of the services in their portfolio, this underground cash cow is yet to prove itself in the long term.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wJDSL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wJDSL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QoCNL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QoCNL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=e4uxl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=e4uxl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sXqbl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sXqbl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=khiOL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=khiOL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2cQ2L"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2cQ2L" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HiSTl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HiSTl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/406651187" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 12:55:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/machine">machine</category>
      <category domain="http://securityratty.com/tag/specific virtual machine">specific virtual machine</category>
      <category domain="http://securityratty.com/tag/internal virtual machine">internal virtual machine</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/sensitive code">sensitive code</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/unique virtual machine">unique virtual machine</category>
      <category domain="http://securityratty.com/tag/original code">original code</category>
      <category domain="http://securityratty.com/tag/code virtualizer">code virtualizer</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/406651187/commercialization-of-anti-debugging.html">The Commercialization of Anti Debugging Tactics in Malware</source>
    </item>
    <item>
      <title><![CDATA[For Some, Stealing IDs Means More Than Fast Cash]]></title>
      <link>http://securityratty.com/article/fa339ae0069b559c084077a74a78ce7a</link>
      <guid>http://securityratty.com/article/fa339ae0069b559c084077a74a78ce7a</guid>
      <description><![CDATA[Over a hundred people in the last few years have been charged with stealing IDs of dead people, in order to evade the law for various reasons something that could probably be avoided with better...]]></description>
      <content:encoded><![CDATA[<p>Over a hundred people in the last few years have been charged with stealing IDs of dead people, in order to evade the law for various reasons &#8212; something that could probably be avoided with better computerized ID systems. Granted a hundred out of how many billion in the States is not that many people, however other reasons for ID theft are sometimes overlooked when we talk about scams. Here are some of the details:</p>
<blockquote><p>Several of the defendants have been convicted of stealing dead people&#8217;s identities to cover up their status as illegal immigrants, military deserters or convicted drunken drivers, federal officials said.</p>
<p>Between July 2005 and August of this year, 112 people were charged in federal court as part of the investigation, which federal officials called &#8220;Operation Deathmatch.&#8221; Authorities seized $650,000 in cash, a Mercedes-Benz, three guns and more than 80 of the fraudulent passports.</p></blockquote>
<p>For more case studies, read the article in the <a rel="nofollow" target="_blank" href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/09/17/BAVV12VO5L.DTL&amp;feed=rss.bayarea">SF Gate </a>(online version of the Chronicle).</p>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 07:54:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dead people">dead people</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/federal officials">federal officials</category>
      <category domain="http://securityratty.com/tag/dead peoples identities">dead peoples identities</category>
      <category domain="http://securityratty.com/tag/operation deathmatch">operation deathmatch</category>
      <category domain="http://securityratty.com/tag/military deserters">military deserters</category>
      <category domain="http://securityratty.com/tag/ids">ids</category>
      <category domain="http://securityratty.com/tag/reasons">reasons</category>
      <category domain="http://securityratty.com/tag/illegal immigrants">illegal immigrants</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/396532338/">For Some, Stealing IDs Means More Than Fast Cash</source>
    </item>
    <item>
      <title><![CDATA[MadMACs seems to have an issue with the Intel Wireless WiFi Link 4965AGN chipset]]></title>
      <link>http://securityratty.com/article/fbce25146fcc827b766a32858a596db2</link>
      <guid>http://securityratty.com/article/fbce25146fcc827b766a32858a596db2</guid>
      <description><![CDATA[I've added the following note to the MadMACs page: A patron of my website pointed out that MadMACs, and other similar tools, seem to have a problem randomizing the MAC address under Windows Vista if...]]></description>
      <content:encoded><![CDATA[I've added the following note to the MadMACs page: A patron of my website 
pointed out that MadMACs, and other similar tools, seem to have a problem 
randomizing the MAC address under Windows Vista if you are using the Intel 
Wireless WiFi Link 4965AGN chipset. It will work with the 4965AGN&nbsp; if you 
randomize only the last two digits, and start it with the prefix 1234567890. It 
will also let you set the whole MAC address to DEADBEEFCAFE, or even let you 
randomize all 12 hex digits. However, if you take the default prefix of 00, 
MadMACs will make a random address up and put it in the NetworkAddress registry 
value, but the 4965AGN chipset drivers will not honor it. If anyone knows why, 
please <a href="http://www.irongeek.com/i.php?page=contact">contact me</a>.<img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/6K5-ravkA9Y" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 31 Aug 2008 11:51:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/madmacs">madmacs</category>
      <category domain="http://securityratty.com/tag/4965agn">4965agn</category>
      <category domain="http://securityratty.com/tag/mac address">mac address</category>
      <category domain="http://securityratty.com/tag/4965agn chipset drivers">4965agn chipset drivers</category>
      <category domain="http://securityratty.com/tag/madmacs page">madmacs page</category>
      <category domain="http://securityratty.com/tag/default prefix">default prefix</category>
      <category domain="http://securityratty.com/tag/digits">digits</category>
      <category domain="http://securityratty.com/tag/hex digits">hex digits</category>
      <category domain="http://securityratty.com/tag/prefix">prefix</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/6K5-ravkA9Y/i.php">MadMACs seems to have an issue with the Intel Wireless WiFi Link 4965AGN chipset</source>
    </item>
    <item>
      <title><![CDATA[ColdFusion: Hack Me or Help Me]]></title>
      <link>http://securityratty.com/article/9fb9073abbbbfc649c8feeed2afceb21</link>
      <guid>http://securityratty.com/article/9fb9073abbbbfc649c8feeed2afceb21</guid>
      <description><![CDATA[For your consideration, the endless battle between security and convenience
Front and center: ColdFusion
I've been picking on ColdFusion-built apps again a bit lately, and one of my observations has...]]></description>
      <content:encoded><![CDATA[For your consideration, the endless battle between security and convenience.<br />Front and center: ColdFusion.<br />I've been picking on ColdFusion-built apps again a bit lately, and one of my observations has been that consistently, if mismanaged, the verbose error reporting features in ColdFusion can be really problematic.<br /><br /><a href="http://holisticinfosec.org/content/view/78/45/" target="_blank">HIO-2008-0713 JOBBEX JobSite SQLi & XSS</a><br /><a href="http://holisticinfosec.org/content/view/79/45/" target="_blank">HIO-2008-0729 BookMine SQLi & XSS</a><br /><br />Recently, I stumbled on an example of way too much information disclosure in a few sites running a ColdFusion-built CMS. The error reporting was so verbose it included the base path, data source name, database username, and yes, the <strong>database password</strong>.<br />I've cleaned it up for the protection of all involved, but here's a screen shot of only 1/4 of the details this site coughed up when I tweaked the input to a calendar date variable.<br /><br /><a href="http://3.bp.blogspot.com/_kVOWaY1TAF0/SLblWNYqSmI/AAAAAAAAACc/BIPkxSBOxpg/s1600-h/ColdFusionTMI.png"><img style="float:center; margin:0 10px 10px 0;cursor:pointer; cursor:hand;" src="http://3.bp.blogspot.com/_kVOWaY1TAF0/SLblWNYqSmI/AAAAAAAAACc/BIPkxSBOxpg/s320/ColdFusionTMI.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5239627386205129314" /></a><br /><br />When I reached out to the developers of this app (always and immediately responsive), they assured me that this was not due to a flaw in the app, but that the "information should be protected, and is by default for our installations" and that the client disabled the security check and turned debugging on. I accept this explanation entirely, but it leads to the classic debate around the dangers of mismanaged debugging features, be they developer added or ColdFusion feature driven. Stupid user tricks are always an issue, but how much rope should they be given to hang themselves? Does error reporting really need to include the database username and password?<br /><br />Allow me to present a few different perspectives.<br />First, rvdh's take on <a href="http://www.0x000000.com/?i=610" target="_blank">Attacking ColdFusion</a>. Developers can learn a lot from this post, if only in that it precisely points out attack vectors. Ronald sums up my concerns aptly:<br />"As we know, error messages are important. Especially error messages generated by database software we want to inject. This, is useful for obtaining information about table structures that can be a real time-saver for attackers. If the right information is available, attackers do not have to guess database tables and fields anymore, nor having to brute force them. I have never seen so much information regarding the site's structure, used database, table names, drivers, server setup and other information useful for attackers that those of ColdFusion. It almost says: Please Hack Me!"<br />As I can't presume to improve on this stance, I won't. Well said.<br /><br />Next, a developer's take on the issue from <a href="http://www.usefulconcept.com/" target="_blank">Joshua Cyr</a>, who has declared it <a href="http://www.usefulconcept.com/index.cfm/2008/8/27/ColdFusion-Errors-and-Security" target="_blank">Check Your Error Output Day</a>. Joshua highlights two key points:<br />1) Do NOT enable the robust errors setting in CF Administrator.<br />2) Don't forget to remove debugging dump code.<br />Heed this advice, ColdFusion fans!<br /><br />One destination that all "secure" ColdFusion paths should lead to is the use of <em>cfqueryparam</em>. Ronald spells it out well mid way through his <a href="http://www.0x000000.com/?i=610" target="_blank">discussion</a>, and so do the following resources:<br /><a href="http://www.coldfusionjedi.com/index.cfm/2008/7/29/What-Folks-arent-using-cfqueryparam" target="_blank">coldfusionjedi</a><br /><a href="http://www.coldfusionmuse.com/index.cfm/2008/7/28/cfqueryparam-protects-against-daleks" target="_blank">Coldfusion Muse</a><br /><br />Further excellent resources for ColdFusion security issues:<br /><a href="http://www.coldfusionmuse.com/index.cfm/2008/7/18/Injection-Using-CAST-And-ASCII" target="_blank">SQL Injection Part II (Make Sure You Are Sitting Down)</a><br /><a href="http://www.12robots.com/index.cfm/Security" target="_blank">12Robots.com</a><br /><br />In closing, security and convenience needn't always be at odds, but often allowing for both requires a higher state of awareness for developers and end-users. Let common sense prevail; perhaps it'll give me less to do in the way of <a href="http://holisticinfosec.org/content/category/6/23/45/" target="_blank">research</a>. ;-)<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/08/coldfusion-hack-me-or-help-me.html&title=ColdFusion:%20Hack%20Me%20or%20Help%20Me " title="ColdFusion: Hack Me or Help Me ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/08/coldfusion-hack-me-or-help-me.html" title="ColdFusion: Hack Me or Help Me ">digg</a>]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 06:13:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coldfusion">coldfusion</category>
      <category domain="http://securityratty.com/tag/coldfusion paths">coldfusion paths</category>
      <category domain="http://securityratty.com/tag/coldfusion fans">coldfusion fans</category>
      <category domain="http://securityratty.com/tag/coldfusion security issues">coldfusion security issues</category>
      <category domain="http://securityratty.com/tag/error">error</category>
      <category domain="http://securityratty.com/tag/database">database</category>
      <category domain="http://securityratty.com/tag/database username">database username</category>
      <category domain="http://securityratty.com/tag/error messages">error messages</category>
      <category domain="http://securityratty.com/tag/coldfusion feature">coldfusion feature</category>
      <source url="http://holisticinfosec.blogspot.com/2008/08/coldfusion-hack-me-or-help-me.html">ColdFusion: Hack Me or Help Me</source>
    </item>
    <item>
      <title><![CDATA[Red Light Cameras Don't Work]]></title>
      <link>http://securityratty.com/article/8352bdbeaa301a76267200c64791415d</link>
      <guid>http://securityratty.com/article/8352bdbeaa301a76267200c64791415d</guid>
      <description><![CDATA[Interesting : the solution to one problem causes another. &quot;The rigorous studies clearly show red-light cameras don't work,&quot; said lead author Barbara Langland-Orban, professor and chair of health...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.ridelust.com/red-light-cameras-just-dont-work/">Interesting</a>: the solution to one problem causes another.</p>

<blockquote>"The rigorous studies clearly show red-light cameras don't work," said lead author Barbara Langland-Orban, professor and chair of health policy and management at the USF College of Public Health. "Instead, they increase crashes and injuries as drivers attempt to abruptly stop at camera intersections."

<p>Comprehensive studies from North Carolina, Virginia, and Ontario have all reported cameras are associated with increases in crashes. The study by the Virginia Transportation Research Council also found that cameras were linked to increased crash costs. The only studies that conclude cameras reduced crashes or injuries contained "major research design flaws," such as incomplete data or inadequate analyses, and were always conducted by researchers with links to the Insurance Institute for Highway Safety. The IIHS, funded by automobile insurance companies, is the leading advocate for red-light cameras since insurance companies can profit from red-light cameras by way of higher premiums due to increased crashes and citations.</blockquote></p>

<p>And, of course, the agenda of the government is to increase revenue due to fines:</p>

<blockquote>A 2001 paper by the Office of the Majority Leader of the U.S. House of Representatives reported that red-light cameras are "a hidden tax levied on motorists." The report came to the same conclusions that all of the other valid studies have, that red-light cameras are associated with increased crashes and that the timings at yellow lights are often set too short to increase tickets for red-light running. That's right, the state actually tampers with the yellow light settings to make them shorter, and more likely to turn red as you're driving through them.

<p>In fact, six U.S. cities have been found guilty of shortening the yellow light cycles below what is allowed by law on intersections equipped with cameras meant to catch red-light runners. Those local governments have completely ignored the safety benefit of increasing the yellow light time and decided to install red-light cameras, shorten the yellow light duration, and collect the profits instead.</p>

<p>The cities in question include Union City, CA, Dallas and Lubbock, TX, Nashville and Chattanooga, TN, and Springfield, MO, according to Motorists.org, which collected information from reports from around the country.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=GkyduK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=GkyduK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=gARYoK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=gARYoK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 08:19:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/red">red</category>
      <category domain="http://securityratty.com/tag/red-light">red-light</category>
      <category domain="http://securityratty.com/tag/red-light runners">red-light runners</category>
      <category domain="http://securityratty.com/tag/install red-light cameras">install red-light cameras</category>
      <category domain="http://securityratty.com/tag/cameras">cameras</category>
      <category domain="http://securityratty.com/tag/red-light cameras">red-light cameras</category>
      <category domain="http://securityratty.com/tag/conclude cameras">conclude cameras</category>
      <category domain="http://securityratty.com/tag/studies">studies</category>
      <category domain="http://securityratty.com/tag/rigorous studies">rigorous studies</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/red_light_camer.html">Red Light Cameras Don't Work</source>
    </item>
    <item>
      <title><![CDATA[Reputation Damage & Measurement]]></title>
      <link>http://securityratty.com/article/d9577961443ca1c3cd93223077fbca5f</link>
      <guid>http://securityratty.com/article/d9577961443ca1c3cd93223077fbca5f</guid>
      <description><![CDATA[Reputation damage can be one of the most difficult concepts to build measurements around. In fact, it can be difficult to develop the actual metrics for the measurements, as well. Damage to things...]]></description>
      <content:encoded><![CDATA[<p>Reputation damage can be one of the most difficult concepts to build measurements around.  In fact, it can be difficult to develop the actual metrics for the measurements, as well.  Damage to things like &#8220;corporate reputation&#8221; and &#8220;goodwill&#8221; and &#8220;brand equity&#8221; can be difficult to wrap even reasonable dollar estimates around (When I use FAIR, I really only care to use one metric when describing loss magnitudes - the almighty currency).</p>
<p>Complicating factors is the impact (or lack thereof) of incidents on stock price.  Many researchers who identify themselves with the <strong><a href="http://www.amazon.com/New-School-Information-Security/dp/0321502787">New School of Information Security</a></strong> (yours truly included) want to immediately look at stock price as a bell-weather metric for incident impact.  I think this stems from our days of slinging FUD, back when we could scream &#8220;Buy a firewall or we&#8217;ll have an incident and you&#8217;ll be on the front page of the paper and the stock price will go down!&#8221;  But these days notable incidents seem to suggest that the impact on stock price for an incident is short lived.  <em><strong>With qualifications, of course.</strong></em></p>
<p>So what would/should we make of this from <a href="http://www.money.co.uk/article/1001229-12-million-wiped-off-helphire-stock-after-malicious-gmail-sent-to-clients.htm">Money.co.uk</a>?</p>
<p style="text-align: center;"><strong>£12million ($24m) Wiped off Helphire Stock after Malicious Email Sent to Clients</strong></p>
<blockquote><p>Car hire firm Helphire have taken Google to court after a malicious email sent from a Gmail account saw their shares plummet £12million in a single day.</p>
<p>The Bath-based business who specialise in providing replacement cars to &#8216;no-fault&#8217; drivers involved in accidents on behalf of car insurance companies, initiated legal proceedings against the search engine giant as part of their attempt to find out who is responsible for sending the defamatory mailing.</p>
<p>Google are now known to have complied with the court order and have controversially supplied details of the email account and ISP used by the meddler.</p>
<p>Written under the psudoname Peter Franks, the 1200 word email is know to have been sent from a gmail account that was opened specifically for this purpose and closed a few minutes after the damage had been done&#8230;</p>
<p>&#8230;The misdemeanour couldn’t have come at a worse time for the struggling firm who have undergone a £45million rights issue and seen a 75% drop in the value of their stock already this year.</p></blockquote>
<p>That last paragraph, for me, explains some of the difficulty in tying reputation damage to stock decreases.  It&#8217;s like when you read the headlines from Bloomberg about why the days stocks (or commodity) prices are up or down.  You know, the &#8220;Oil closes $3 higher on news that a notable South American dictator has a rather unpleasant boil in a very uncomfortable area&#8221; type of headlines.  You really do have to question the causality and correlation.  So in the Helphire case above - is this new drop in stock really because of the email sent?  If so, should we view that $24mil number as an independent data point to describe this sort of attack on reputation, or is the magnitude aggravated due to the long-term trend of stock price?</p>
<p>Even when we have &#8220;Objective Data&#8221; (an in-joke for Adam S.) like this decline in stock price, it is really difficult to provide any sort of precise estimate or measurement - about the future, present or past.  The best we can do is use ranges, distributions, that are reasonable based on evidence and observation.</p>
<p>So it&#8217;s worth filing away this sort of datum for future use - while dutifully acknowledging the qualifiers we might place around it.</p>
<p>So the questions I ask here - what should we make of this new information, and how should we view the $24million drop - they&#8217;re not rhetorical.  I am very interested in your views and welcome your comments!</p>
]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 10:33:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stock">stock</category>
      <category domain="http://securityratty.com/tag/helphire stock">helphire stock</category>
      <category domain="http://securityratty.com/tag/reputation damage">reputation damage</category>
      <category domain="http://securityratty.com/tag/reputation">reputation</category>
      <category domain="http://securityratty.com/tag/stock price">stock price</category>
      <category domain="http://securityratty.com/tag/damage">damage</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/email account">email account</category>
      <category domain="http://securityratty.com/tag/malicious email">malicious email</category>
      <source url="http://riskmanagementinsight.com/riskanalysis/?p=387">Reputation Damage &amp; Measurement</source>
    </item>
    <item>
      <title><![CDATA[Social Security Numbers Displayed On Maryland Courts Website]]></title>
      <link>http://securityratty.com/article/3673e83b82a7929a886ca9493f5a2ee9</link>
      <guid>http://securityratty.com/article/3673e83b82a7929a886ca9493f5a2ee9</guid>
      <description><![CDATA[Drivers in Virginia and Washington, D.C. whose drivers licenses have their Social Security numbers and who got traffic tickets in Maryland will find those numbers and other personal information on a...]]></description>
      <content:encoded><![CDATA[Drivers in Virginia and Washington, D.C. whose driver&#8217;s licenses have their Social Security numbers and who got traffic tickets in Maryland will find those numbers and other personal information on a Maryland state Web site. Maryland has never used Social Security numbers when issuing driver’s licenses, but Virginia and the District have.
Traffic citations are listed [...]]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 12:41:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/maryland">maryland</category>
      <category domain="http://securityratty.com/tag/drivers">drivers</category>
      <category domain="http://securityratty.com/tag/drivers licenses">drivers licenses</category>
      <category domain="http://securityratty.com/tag/virginia">virginia</category>
      <category domain="http://securityratty.com/tag/traffic citations">traffic citations</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/traffic tickets">traffic tickets</category>
      <source url="http://cyberinsecure.com/social-security-numbers-displayed-on-maryland-courts-website/">Social Security Numbers Displayed On Maryland Courts Website</source>
    </item>
    <item>
      <title><![CDATA[CTW Library Consortium Computers Containing A Database Breached By Hackers]]></title>
      <link>http://securityratty.com/article/48e491531ce5b90440ddbf0f937d366b</link>
      <guid>http://securityratty.com/article/48e491531ce5b90440ddbf0f937d366b</guid>
      <description><![CDATA[Two computer servers containing a database of Connecticut College, Wesleyan University and Trinity College library patrons were accessed by hackers, Connecticut College officials said Friday. The...]]></description>
      <content:encoded><![CDATA[Two computer servers containing a database of Connecticut College, Wesleyan University and Trinity College library patrons were accessed by hackers, Connecticut College officials said Friday. The database included the names, addresses, social security and driver’s license numbers. The personal information on the servers belonged to 12 Wesleyan University library patrons, approximately 2,800 Connecticut College library [...]]]></content:encoded>
      <pubDate>Tue, 29 Jul 2008 06:46:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/connecticut college">connecticut college</category>
      <category domain="http://securityratty.com/tag/connecticut college library">connecticut college library</category>
      <category domain="http://securityratty.com/tag/connecticut college officials">connecticut college officials</category>
      <category domain="http://securityratty.com/tag/database">database</category>
      <category domain="http://securityratty.com/tag/computer servers">computer servers</category>
      <category domain="http://securityratty.com/tag/servers">servers</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/drivers license">drivers license</category>
      <source url="http://cyberinsecure.com/ctw-library-consortium-computers-containing-a-database-breached-by-hackers/">CTW Library Consortium Computers Containing A Database Breached By Hackers</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-07-22 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/6e863ea0d836fdb6013ed12bd7b5ccef</link>
      <guid>http://securityratty.com/article/6e863ea0d836fdb6013ed12bd7b5ccef</guid>
      <description><![CDATA[NitroSecuritys Acquisition of RippleTech | securosis.com
Individual Privacy vs. Business Drivers | securosis.com
What goes up... (virtualization market) | Security Incite: Analysis on Information...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://securosis.com/2008/07/21/nitrosecuritys-acquisition-of-rippletech/">NitroSecurity&rsquo;s Acquisition of RippleTech | securosis.com</a></li>
<li><a href="http://securosis.com/2008/07/21/individual-privacy-vs-business-drivers/">Individual Privacy vs. Business Drivers | securosis.com</a></li>
<li><a href="http://securityincite.com/blog/mike-rothman/what-goes-up-virtualization-market">What goes up... (virtualization market) | Security Incite: Analysis on Information Security</a></li>
<li><a href="http://securityincite.com/blog/mike-rothman/incite-redux-day-9-get-the-jumper-cables-for-dlp">Incite Redux: Day 9 - Get the jumper cables for DLP | Security Incite: Analysis on Information Security</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/343213511" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security incite">security incite</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/business drivers">business drivers</category>
      <category domain="http://securityratty.com/tag/individual privacy">individual privacy</category>
      <category domain="http://securityratty.com/tag/virtualization market">virtualization market</category>
      <category domain="http://securityratty.com/tag/nitrosecuritys acquisition">nitrosecuritys acquisition</category>
      <category domain="http://securityratty.com/tag/jumper cables">jumper cables</category>
      <category domain="http://securityratty.com/tag/analysis">analysis</category>
      <category domain="http://securityratty.com/tag/incite redux">incite redux</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/343213511/anton18">Links for 2008-07-22 [del.icio.us]</source>
    </item>
  </channel>
</rss>
